Understand your data.
Control what you save.

What we collect and why

• Sign-in identity: Neon Auth stores sign-in identities and sessions and supplies a verified account ID and email to authenticate requests. Projects, preferences and support requests are linked to the account ID; sign-in information is kept in the authentication database.
• Research: budget range, time, target market, skills, selling preferences, ideas and any discovery constraints you submit. These are used to generate the requested report and saved with it.
• Workspace: reports, sources, plan edits, tasks and evidence notes, stored so you can reopen and revise them. The Business workspace also stores the business profile, manually entered revenue and aggregate costs, decision assumptions, risks, actions and monthly reviews you save. When you start an automated Business review, upload accounts, connect an accounting organisation or save subsequent business edits, relevant workspace inputs are sent to OpenAI to prepare or update the review and action plan. Scheduled source refreshes can also update it; these can be paused in Sources & connections. The completed assessment and its dated input snapshot are stored with your workspace, so you can review its basis later. Business action status changes alone do not trigger AI analysis. Private financial and operating information is excluded from web-search inputs. A demo assessment sends the demo inputs and question, but its result stays in the browser tab and is not saved to your account.
• Business and competitor research: as part of an automated review, its name, website, sector and the public market/location details you provide are sent to OpenAI web search. Uploaded documents, financial figures, goals, private operating notes and customer or employee records are excluded from these search inputs. The sourced findings, proposed profile, research date and whether the company match was automatic or checked by you are saved privately with the workspace. Approved research can inform subsequent Business assessments and their saved evidence snapshots.
• Support and Business pilot enquiries: your message, topic, response and timestamps, used to handle your request. Business enquiries also include your contact name, verified account email, business name, sector, team size, the decision you want to explore, the service stage you are interested in and your contact preference. If you request a phone conversation, we also store the number and availability you provide so we can arrange it. These enquiries are stored in the support inbox and are not sent to AI.
• Purchases: order references, amount, currency, payment status, terms version and credit usage are linked to your account. Stripe processes card details; brighterdesk does not store card numbers.
• Optional measurement: fixed activity names, account ID and date, only after you opt in. Ideas and report text are excluded.

Proposed lawful bases — confirmation needed

The proposed basis for requested account, research, workspace and support features is performance of the service agreement. Optional product-usage measurement relies on your consent, which you can withdraw in Data & preferences. Operational security may rely on legitimate interests where applicable.

The operator must confirm and document the appropriate lawful bases and any legitimate-interest assessment before public launch. This draft does not claim that review has been completed.

AI, hosting and other recipients

Submitted research and discovery inputs are sent to OpenAI for generation and web search. Business AI assessments send the relevant workspace inputs and question to OpenAI for analysis without web search. brighterdesk does not use Business workspace inputs to train a shared model. OpenAI API data is not used to train its models by default; its applicable data controls and operational retention still apply. Requests use store:false, which is not a promise of zero provider retention. OpenAI may retain abuse-monitoring logs for up to 30 days under its standard API settings; see OpenAI’s data controls. The Vercel deployment uses Vercel hosting, a Neon PostgreSQL database and Neon Auth authentication. Stripe receives the checkout email, order reference and account identifier to process payments, provide receipts and handle refunds or disputes. Fonts are requested from Google Fonts.

Provider processing locations, international transfer safeguards, retention terms and the relevant contractual roles need to be confirmed by the operator before public launch. Do not submit sensitive personal data, customer records, passwords or confidential materials.

Business imports and people directory

Uploaded reports are temporarily stored in the private account database while a background extraction job runs. Originals are deleted after successful extraction; failed-job uploads are cleared on the next daily retention check after 24 hours. Extracted figures, source excerpts, validation status, corrections and dated review snapshots remain with the workspace until deleted. Keep your own original reports. Companies House supplies registered office-holders, and official websites can supply publicly listed roles. Neither is treated as a complete employee roster. You can correct or archive records and add people privately; no invitations or messages are sent. Accounting connections read reports after provider consent and organisation selection. Disconnecting stops future retrieval; previously imported figures remain until removed.

Retention and deletion

Workspace content and support requests remain until you delete them or the operator removes them in response to a request. You can delete individual projects or all saved workspace content from the application. Deletion removes the records from the active application database; hosting backups and provider operational logs have separate retention.

A minimal account-ID, preference and generation record remains after workspace deletion to prevent delayed operations restoring removed content. Purchase records and credit usage are retained separately to fulfil purchases, prevent duplicate charges and support refunds, disputes and accounting obligations. Workspace deletion does not erase those financial records. Analytics consent is reset to off. For a request covering that record or provider-held data, contact the operator.

Optional usage records older than 90 days are excluded from reporting and removed on the next usage collection or summary request. Turning measurement off removes the existing usage records for your account immediately from the active database.

Your choices and rights

Use Data & preferences to export your saved application data, withdraw optional measurement consent or delete workspace content. Correct plan and evidence entries in the dashboard. Original research is retained separately; delete its project if you do not want it stored.

Depending on the circumstances and lawful basis, you may have rights of access, correction, erasure, restriction, portability and objection. In particular, you can object to processing based on legitimate interests. Use Contact for a privacy request. You may also complain to the Information Commissioner’s Office.

Device storage and policy updates

No advertising pixels have been added. Optional usage measurement uses first-party requests and your saved account preference; no tracking ID is stored in browser local storage. The sign-in provider may use cookies needed for authentication. Worksheet entries and Business demo edits clear on reload. Startup example edits survive reloads in this tab using session storage. Before checkout, your current form is stored in this browser tab’s session storage so you can return to it after payment. It is cleared after a successful run or when the tab closes; drafts older than 24 hours are discarded when the page loads.

Last updated: 6 November 2026. Changes to this notice will be published here. Before introducing a new optional use of data, the relevant choice and explanation must be updated.

Business decisions and pilot applications

Private Business records include decisions, baseline and actual measurements, follow-up reviews, the latest AI assessment and up to ten previous assessment snapshots. These are included in account data exports and removed when workspace content is deleted.

A public pilot application is stored separately for owner review. Its email address is unverified and does not link the application to an account. Applications and owner support notes are not part of account exports or account deletion. Contact support@idearove.com about access or deletion of an application; the team must verify the request. Application details are used for assessment and reply, not automatic marketing. No automatic confirmation email is sent.

Application abuse protection records hashed client identifiers and email addresses with daily counters. The operator must confirm the retention schedule and wider provider arrangements before public use.

Financial uploads and accounting connections

Reports and images are sent to OpenAI to extract proposed figures. Originals are processed in memory and not retained by brighterdesk. Keep your original document. Extracted figures, short source excerpts, import history and confirmed review snapshots are stored privately until you remove them or delete workspace content. Provider processing and operational-log retention are separate.

Confirming an import records the account, time and source. Removing an import record does not remove confirmed figures or previous assessment snapshots. Undo only restores values that have not been changed since that import. Full workspace deletion removes the import records, financial observations, reviews and stored accounting credentials from the active database.

Accounting tokens are encrypted server-side. Disconnecting removes our stored credentials and attempts provider revocation; you should also review connected apps in the accounting provider. Confirmed records remain until removed. QuickBooks grants broad Accounting access, but brighterdesk only calls read-report endpoints. Companies House searches use public company data and do not prove ownership.

Upload only information you are authorised to share. Use aggregate business reports and avoid unnecessary personal records or account credentials. Extraction is limited to 8 attempts per account and 40 across the pilot per UTC day by default, separately from Start credits. No report is independently audited.